CVE-2026-100348 in kin-openapi
Summary
by MITRE • 10/15/2026
kin-openapi is a Go project for handling OpenAPI files. Prior to 0.145.0, openapi3.Loader can dereference a nil SchemaRef.Value while resolving a self-referential additionalProperties JSON Reference such as a schema that points to its own additionalProperties member. Loading an attacker-controlled OpenAPI document through LoadFromData, LoadFromFile, or LoadFromURI reaches resolveComponent before document validation and can panic the loading process. Resolved additionalProperties schemas and ordinary recursive schemas do not take the vulnerable nil-value path. This issue is fixed in version 0.145.0.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/15/2026
The kin-openapi library serves as a critical component for Go-based applications that need to parse, validate, and manipulate OpenAPI specification documents. These specifications define the structure of RESTful APIs, detailing endpoints, parameters, request bodies, and response schemas. The openapi3 package within this library provides functionality to load these documents from various sources such as in-memory data strings, local file systems, or remote URIs. A significant security flaw was identified in versions prior to 0.145.0 regarding the handling of self-referential JSON References within schema definitions. Specifically, the vulnerability resides in the dereferencing logic used by openapi3.Loader when resolving circular references involving additionalProperties fields. This issue highlights a critical gap between document loading and validation phases, allowing malformed or maliciously crafted inputs to trigger internal runtime errors before security checks can be applied.
The technical root cause of this vulnerability lies in how the loader resolves recursive schema definitions. When an OpenAPI document contains a schema that references its own additionalProperties member through a JSON Reference, the resolution process enters a loop-like state if not properly guarded against nil values. In standard scenarios where resolved schemas are handled correctly or when dealing with ordinary recursive structures, the code path avoids this specific failure mode. However, in the case of self-referential additionalProperties references, the loader attempts to dereference a SchemaRef.Value that has not yet been initialized or is null during the traversal process. Because the LoadFromData, LoadFromFile, and LoadFromURI methods invoke resolveComponent before performing full document validation, they do not have access to context that would prevent this premature dereferencing attempt. Consequently, when an attacker supplies a crafted OpenAPI file containing such a circular reference structure, the Go runtime encounters a nil pointer exception, resulting in a panic.
This vulnerability primarily manifests as a Denial of Service (DoS) condition against services that process untrusted API definitions using kin-openapi prior to version 0.145.0. Since the application crashes due to an unrecovered panic, any service relying on this library for parsing incoming or uploaded OpenAPI specifications will become unavailable until restarted. This is particularly dangerous in environments where developers or automated systems ingest external API documentation from third parties without rigorous pre-validation. The impact extends beyond simple availability loss; if the affected component is part of a larger attack surface, such as an API gateway configuration manager or a developer portal that accepts user-submitted specs, it could disrupt critical business operations and degrade trust in the platform's stability.
From a classification perspective, this flaw aligns with CWE-476: NULL Pointer Dereference, which describes errors resulting from dereferencing null pointers leading to unexpected termination of execution. In terms of offensive security frameworks, this vulnerability can be mapped to MITRE ATT&CK technique T1499: Endpoint Denial of Service, specifically under the sub-category of resource exhaustion via application crashes. The attack vector is classified as Network-based if the OpenAPI document is fetched from a URI, or Local/Remote depending on whether it is loaded from file storage provided by an attacker. It represents a classic case where input validation and sanitization are insufficiently separated from parsing logic, allowing malformed data to trigger internal exceptions before security controls can intervene.
To mitigate this vulnerability, organizations must immediately upgrade the kin-openapi library to version 0.145.0 or later, which includes patches for handling these self-referential additionalProperties cases safely without causing panics. For systems that cannot be updated instantly due to dependency constraints, implementing a pre-validation step is recommended. This involves running basic structural checks on incoming OpenAPI documents before passing them to the loader, ensuring that circular references are either removed or handled by a custom resolver that tracks visited nodes to prevent infinite loops and nil dereferences. Additionally, developers should wrap loading operations in defer recover blocks as a temporary defensive measure to catch panics gracefully and return appropriate error messages rather than crashing the entire process. Regular auditing of third-party Go dependencies is essential to maintain resilience against such library-level vulnerabilities.